feat(v2/infrastructure): read the contract on demand from configurable paths

DefaultConfig reads the infrastructure contract once per process from fixed paths and caches the result, including a failed read. Two callers cannot use it: a service that must observe a contract change without a restart, such as a workflow database registered after the process started, and tools or tests that keep the contract at other paths, such as a migration Job.

Load(ctx, paths Paths, opts ...Option) reads the contract on every call from the given paths. All three Paths fields are required, so a partially filled struct fails naming the field instead of reading a production mount; DefaultPaths() returns the platform's paths, and DefaultConfig now calls Load with them inside its sync.OnceValues, unchanged in behavior. WithStrictMode() is the first option, for tools and CI that validate a hand-written contract; a service must not use it because it breaks rollback across contract versions. The returned Config owns no resources.

The second commit changes Config.TLSSecrets from *secret.FileProvider to secret.Provider, as Secrets already is. Assigning a *FileProvider to the field and calling Get through it compile unchanged; reading the field back into a *FileProvider variable needs a type assertion, and none exists in this repository. A typed-nil *FileProvider in the field keeps returning not-found, because (*FileProvider).Get guards its nil receiver, so the Redis client still ends up without a TLS configuration. Its only consumer is the Redis client, which already takes the interface. It is a separate commit so it can be dropped if the field type is considered frozen.

The first consumer is GitLab Relay, which reads the contract for autocore's databases at every worker start (gitlab-org/cluster-integration/gitlab-agent#1091).

Closes #151 (closed)